MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 472cd6b387af109c0a42b9531a8a630b412ccb3183c8a80f20e298e1186081ee. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 472cd6b387af109c0a42b9531a8a630b412ccb3183c8a80f20e298e1186081ee
SHA3-384 hash: a3a53fddbf2506afac5d84e94c431bb5b20e0ba4cee471ede566c4c2949f46731d22f3fb33b3d9a395326346bb108fe1
SHA1 hash: d4c30eb1f6bc832ee06069dd02a92daaa9566d02
MD5 hash: bce07ea94d38eff487e0c797d45ce7d9
humanhash: oxygen-harry-lithium-paris
File name:bce07ea94d38eff487e0c797d45ce7d9.dll
Download: download sample
Signature Dridex
Create hunting rule
File size:310'981 bytes
First seen:2021-02-14 07:50:22 UTC
Last seen:2021-02-14 09:53:43 UTC
File type:DLL dll
MIME type:application/x-dosexec
ssdeep 6144:AfI9lZeImUv/UCSZbYnwzP5SYLJfQqksIFhPYdle:eI/ZeIzkCcYEJJf4hwK
TLSH FA64CF603919D53EC926067ACD9BC6FDA1283DEDCF12281772D82F6F76752827B23205
Reporter abuse_ch
Tags:dll Dridex

Intelligence

File Origin
# of uploads :
2
# of downloads :
242
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/117064/
Detection(s):
SecuriteInfo.com.Variant.Mikey.118806.10167.28371.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
suspicious
Classification:
n/a
Score:
23 / 100
Link:
https://www.joesandbox.com/analysis/607549
Signature
Machine Learning detection for sample
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 352803 Sample: 1jkRVhJpxP.dll Startdate: 14/02/2021 Architecture: WINDOWS Score: 23 34 Machine Learning detection for sample 2->34 14 loaddll32.exe 1 2->14         started        process3 process4 16 rundll32.exe 14->16         started        process5 18 rundll32.exe 16->18         started        process6 20 rundll32.exe 18->20         started        process7 22 rundll32.exe 20->22         started        process8 24 rundll32.exe 22->24         started        process9 26 rundll32.exe 24->26         started        process10 28 rundll32.exe 26->28         started        process11 30 rundll32.exe 28->30         started        process12 32 rundll32.exe 30->32         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/472cd6b387af109c0a42b9531a8a630b412ccb3183c8a80f20e298e1186081ee/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=i4wnnm4hv4ijycscxfjrvctdbnaszszrqpekqdza4kmocgdaqhxa._file
Verdict:
unknown
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/210214-p6pzbxra2x/
Behaviour
Suspicious use of WriteProcessMemory
Unpacked files
SH256 hash:
472cd6b387af109c0a42b9531a8a630b412ccb3183c8a80f20e298e1186081ee
MD5 hash:
bce07ea94d38eff487e0c797d45ce7d9
SHA1 hash:
d4c30eb1f6bc832ee06069dd02a92daaa9566d02
Link:
https://www.unpac.me/results/3e234c5c-3cde-473b-b72c-b54206a9be1c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.30
Link:
https://yomi.yoroi.company/submissions/472cd6b387af109c0a42b9531a8a630b412ccb3183c8a80f20e298e1186081ee

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll 472cd6b387af109c0a42b9531a8a630b412ccb3183c8a80f20e298e1186081ee

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/995237/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/117064/

Comments